The update window is where you get hit now. An unidentified attacker went after OPSSHIELD, the vendor behind cPGuard. CISA added a TOCTOU race condition in WordPress Core, CVE-2026-119977, exploited during the upgrade window, and The Hacker News reports CISA confirmed active exploitation. Trusted updates are still code paths nobody owns. We inventory update channels across your fleet: pinned versions, signature checks, egress review. Send us your server list and we'll scope it in a day.
Was this useful?